Cisco SecureX.pdf

1. Wildhani I R Cybersecurity Specialist SecureX

2. Agenda SecureX Value Proposition Understanding SecureX Demo SecureX Automated Threat Hunting Investigation Demo SecureX Orchestration Custom Response Actions 1 2 3 4

4. © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential Top Customer Challenge Security Operations Technologies and Intelligence Is this thing bad? Has it affected us? How? Why? Web Security Network Analytics Next-Gen Firewall Email Security Third-Party Sources Secure Internet Gateway Next-Gen IPS Endpoint Security Threat Intel SIEM Identity Management Malware Detection Security Does Not Work Together

5. © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential Investigation Remediation Managed Policy Orchestration Automation Detection Analytics Unified Visibility What is SecureX Customer Infrastructure SIEM/SOAR Identity Third-Party/ITSM Intelligence Cisco Secure Applications Cloud Network Endpoint A Cloud-Native, Built-In Platform Experience Within Our Portfolio Customer Teams ITOps NetOps SecOps

6. © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential SecureX Unlocks Value for Your Customers Integrations built-in, pre-built or custom Ribbon & Sign-on never leaves you maintains context Dashboard customizable for what matters to you Threat Response is at the core of the platform Orchestration drag-drop GUI for no/low code Unified In One Location for Maximized Operational Integrated & Open for Simplicity Visibility Efficiency Device Insights device inventory with the contextual awareness

7. 6 © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential How true simplicity is experienced Before: 32 minutes 2. Investigate incidents in multiple consoles Product dashboard 1 Product dashboard 2 Product dashboard 3 Product dashboard 4 3. Remediate by coordinating multiple teams Product dashboard 1 Product dashboard 2 Product dashboard 3 Product dashboard 4 1. IOC/alert After: 5 minutes SecureX threat response is integrated across your security infrastructure SHA - 256 IP Target endpoint Email Query intel and telemetry from multiple integrated products Subject Quickly visualize the Threat impact in your environment Remediate directly from one UI In one view Malicious domain

8. © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential Cisco Infrastructure Third-Party Infrastructure IT service management, and cloud/virtual and DevOps platforms General Toolsets Scripting/dev tools, system interfaces, data exchanges, and messaging protocols Networking, collaboration, server/ app, and Multicloud management platforms Third-Party Security Operational tools, intelligence sources, infrastructure protections and visibility Meaningful Integrations to Protect your Network HTTP SMTP SNMP …and more! ACI UCS Director CloudCenter DNA Center Cisco Webex

9. 8 © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential A new level of visibility with SecureX dashboard Understand what matters in one view across your security infrastructure • Applications (left) View, launch or trial the integrated products • Tiles (middle) Presents metrics and operational measures from the integrated products • News (right) Product updates, industry news, and blog posts

10. 9 © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential I make automated playbook changes in minutes with a drag- drop interface My top 5 most frustrating tasks have all be automated We have never communicated faster: Our approvals are automated Maximizing operational efficiency After: I combined 9 tasks across 3 security tools, 2 infrastructuresystems, and 3 teams in one keystroke! Solution:Orchestrating security across the full lifecycle Before: Repetitive, human-poweredtasks ALERT task: REMEDIATE Cisco or non-Cisco infrastructure Pre-built or customizable workflows task task task task while loop condition Go To: SecureX threat response deep dive Outdated playbook Automation script that works “sometimes” Playbook Integration script that no longer works

12. 11 © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential SecOps The process of consulting all the modules to find out what any of them know about the observable(s). Enrichment DNS security Etc.. EPP NGIPS EPP logs NGIPS logs DNS logs Etc. SecureX threat response File Analysis Etc . IP reputation Domain reputation

13. 12 © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential SecOps DNS security Etc.. EPP NGIPS SecureX threat response EPP logs NGIPS logs DNS logs Etc. File Analysis Etc . IP reputation Domain reputation Enrichment The process of consulting all the modules to find out what any of them know about the observable(s).

14. 13 © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential SecOps Enrichment DNS security Etc.. EPP NGIPS EPP logs NGIPS logs DNS logs Etc. SecureX threat response File Analysis Etc . IP reputation Domain reputation The process of consulting all the modules to find out what any of them know about the observable(s).

15. 14 SecOps The process of leveraging the capabilities of SecureX-enabled technologies to mitigate threats by acting on observables or targets Response DNS security Etc.. EPP NGIPS EPP logs NGIPS logs DNS logs Etc. SecureX threat response File Analysis Etc . IP reputation Domain reputation © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential

16. 15 © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential SecOps DNS security Etc.. EPP NGIPS SecureX threat response EPP logs NGIPS logs DNS logs Etc. File Analysis Etc . IP reputation Domain reputation Response The process of leveraging the capabilities of SecureX-enabled technologies to mitigate threats by acting on observables or targets

17. 16 © 2023 Cisco and/or its affiliates. All rights reserved. Cisco Partner Confidential I’m a Cisco Secure customer with SecureX threat response My team can: Answer questions faster about observables. Block and unblock domains from threat response. Isolate Hosts Hunt for an observable associated with a known actor and immediately see organizational impact. Save a point in time snapshot of our investigations for further analysis. Document our analysis in a cloud casebook from all integrated or web-accessible tools, via an API. Integrate threat response easily into existing processes and custom tools Store our own threat intel in threat response private intel for use in investigations See Incidents all in one place Block and unblock file executions from threat response

Cisco SecureX.pdf

Cisco SecureX.pdf

Recommandé

Contenu connexe

Similaire à Cisco SecureX.pdf

Similaire à Cisco SecureX.pdf(20)

Dernier

Dernier(20)

Cisco SecureX.pdf